New Windows Error Reporting Vulnerability Lets Attackers Escalate to Gain SYSTEM Access

This report analyzes CVE-2026-20817, a local privilege escalation in WerSvc.dll that lets a low-privileged user abuse ALPC messages to cause Windows Error Reporting to start WerFault.exe with SYSTEM privileges; Microsoft mitigated the risk by disabling the vulnerable elevated-launch feature rather than patching it. The write-up includes exploitation details (ALPC APIs, message flags, file-mapping handle duplication), detection notes (process parent spoofing alerts, Defender signatures), and warnings about malicious proof-of-concept repositories.